mirror_match/__tests__/lib/activity-log.test.ts
ilia df865dca41
All checks were successful
CI / skip-ci-check (push) Successful in 1m25s
CI / lint-and-type-check (push) Successful in 1m50s
CI / test (push) Successful in 1m54s
CI / build (push) Successful in 1m54s
CI / secret-scanning (push) Successful in 1m26s
CI / dependency-scan (push) Successful in 1m31s
CI / sast-scan (push) Successful in 2m34s
CI / workflow-summary (push) Successful in 1m23s
This MR fixes critical authentication issues that prevented login on localhost and improves the developer experience with consolidated rebuild scripts and a working help modal keyboard shortcut. (#5)
# Fix authentication issues and improve developer experience

## Summary

This MR fixes critical authentication issues that prevented login on localhost and improves the developer experience with consolidated rebuild scripts and a working help modal keyboard shortcut.

## Problems Fixed

### 1. Authentication Issues
- **UntrustedHost Error**: NextAuth v5 was rejecting localhost requests with "UntrustedHost: Host must be trusted" error
- **Cookie Prefix Errors**: Cookies were being set with `__Host-` and `__Secure-` prefixes on HTTP (localhost), causing browser rejection
- **MissingCSRF Error**: CSRF token cookies were not being set correctly due to cookie configuration issues

### 2. Help Modal Keyboard Shortcut
- **Shift+? not working**: The help modal keyboard shortcut was not detecting the question mark key correctly

### 3. Developer Experience
- **Multiple rebuild scripts**: Had several overlapping rebuild scripts that were confusing
- **Unused code**: Removed unused `useSecureCookies` variable and misleading comments

## Changes Made

### Authentication Fixes (`lib/auth.ts`)
- Set `trustHost: true` to fix UntrustedHost error (required for NextAuth v5)
- Added explicit cookie configuration for HTTP (localhost) to prevent prefix errors:
  - Cookies use `secure: false` for HTTP
  - Cookie names without prefixes for HTTP
  - Let Auth.js defaults handle HTTPS (with prefixes and Secure flag)
- Removed unused `useSecureCookies` variable
- Simplified debug logging

### Help Modal Fix (`components/HelpModal.tsx`)
- Fixed keyboard shortcut detection to properly handle Shift+? (Shift+/)
- Updated help text to show correct shortcut (Shift+? instead of Ctrl+?)

### Developer Scripts
- **Consolidated rebuild scripts**: Merged `CLEAN_REBUILD.sh`, `FIX_AND_RESTART.sh`, and `start-server.sh` into single `rebuild.sh`
- **Added REBUILD.md**: Documentation for rebuild process
- Removed redundant script files

### Code Cleanup
- Removed unused `useSecureCookies` variable from `lib/auth.ts`
- Removed misleading comment from `app/api/auth/[...nextauth]/route.ts`
- Cleaned up verbose debug logging

## Technical Details

### Cookie Configuration
The fix works by explicitly configuring cookies for HTTP environments:
- **HTTP (localhost)**: Cookies without prefixes, `secure: false`
- **HTTPS (production)**: Let Auth.js defaults handle (prefixes + Secure flag)

This prevents NextAuth v5 from auto-detecting HTTPS from proxy headers and incorrectly adding cookie prefixes.

### Keyboard Shortcut
The question mark key requires Shift+/ on most keyboards. The fix now properly detects:
- `event.shiftKey && event.key === "/"`
- `event.key === "?"` (fallback)
- `event.code === "Slash" && event.shiftKey` (additional fallback)

## Testing

-  Login works on localhost (http://localhost:3000)
-  No cookie prefix errors in browser console
-  No UntrustedHost errors in server logs
-  Help modal opens/closes with Shift+?
-  Rebuild script works in both dev and prod modes

## Files Changed

### Modified
- `lib/auth.ts` - Authentication configuration fixes
- `components/HelpModal.tsx` - Keyboard shortcut fix
- `app/api/auth/[...nextauth]/route.ts` - Removed misleading comment

### Added
- `rebuild.sh` - Consolidated rebuild script
- `REBUILD.md` - Rebuild documentation

## Migration Notes

No database migrations or environment variable changes required. The fix works with existing configuration.

## Related Issues

Fixes authentication issues preventing local development and testing.

Reviewed-on: #5
2026-01-05 19:42:46 -05:00

210 lines
4.7 KiB
TypeScript

import { logActivity } from '@/lib/activity-log';
import { logger } from '@/lib/logger';
// Mock the logger
jest.mock('@/lib/logger', () => ({
logger: {
info: jest.fn(),
debug: jest.fn(),
warn: jest.fn(),
error: jest.fn(),
},
}));
// Helper to create a mock Request object
function createMockRequest(headers: Record<string, string> = {}): Request {
const mockHeaders = new Headers();
Object.entries(headers).forEach(([key, value]) => {
mockHeaders.set(key, value);
});
return {
headers: mockHeaders,
} as unknown as Request;
}
describe('activity-log', () => {
beforeEach(() => {
jest.clearAllMocks();
});
describe('logActivity', () => {
it('should create activity log with all fields', () => {
const mockRequest = createMockRequest({
'x-forwarded-for': '192.168.1.1',
});
const user = {
id: 'user-123',
email: 'test@example.com',
role: 'USER',
};
const details = { photoId: 'photo-456' };
const result = logActivity(
'PHOTO_UPLOAD',
'/api/photos/upload',
'POST',
user,
details,
mockRequest
);
expect(result).toMatchObject({
action: 'PHOTO_UPLOAD',
path: '/api/photos/upload',
method: 'POST',
userId: 'user-123',
userEmail: 'test@example.com',
userRole: 'USER',
ip: '192.168.1.1',
details: { photoId: 'photo-456' },
});
expect(result.timestamp).toBeDefined();
});
it('should handle unauthenticated users', () => {
const result = logActivity(
'PAGE_VIEW',
'/photos',
'GET',
null,
undefined,
undefined
);
expect(result).toMatchObject({
action: 'PAGE_VIEW',
path: '/photos',
method: 'GET',
userId: undefined,
userEmail: undefined,
userRole: undefined,
ip: 'unknown',
});
});
it('should extract IP from x-forwarded-for header', () => {
const mockRequest = createMockRequest({
'x-forwarded-for': '192.168.1.1, 10.0.0.1',
});
const result = logActivity(
'ACTION',
'/path',
'GET',
undefined,
undefined,
mockRequest
);
expect(result.ip).toBe('192.168.1.1');
});
it('should extract IP from x-real-ip header when x-forwarded-for is missing', () => {
const mockRequest = createMockRequest({
'x-real-ip': '10.0.0.1',
});
const result = logActivity(
'ACTION',
'/path',
'GET',
undefined,
undefined,
mockRequest
);
expect(result.ip).toBe('10.0.0.1');
});
it('should use "unknown" for IP when no headers are present', () => {
const mockRequest = createMockRequest();
const result = logActivity(
'ACTION',
'/path',
'GET',
undefined,
undefined,
mockRequest
);
expect(result.ip).toBe('unknown');
});
it('should call logger.info with structured data', () => {
const user = {
id: 'user-123',
email: 'test@example.com',
role: 'USER',
};
const details = { photoId: 'photo-456' };
logActivity(
'PHOTO_UPLOAD',
'/api/photos/upload',
'POST',
user,
details
);
expect(logger.info).toHaveBeenCalledWith(
'Activity: PHOTO_UPLOAD',
expect.objectContaining({
method: 'POST',
path: '/api/photos/upload',
userId: 'user-123',
userEmail: 'test@example.com',
userRole: 'USER',
details: { photoId: 'photo-456' },
})
);
});
it('should not include details in logger call when details are not provided', () => {
const user = {
id: 'user-123',
email: 'test@example.com',
role: 'USER',
};
logActivity(
'PAGE_VIEW',
'/photos',
'GET',
user
);
expect(logger.info).toHaveBeenCalledWith(
'Activity: PAGE_VIEW',
expect.objectContaining({
method: 'GET',
path: '/photos',
userId: 'user-123',
userEmail: 'test@example.com',
userRole: 'USER',
})
);
const callArgs = (logger.info as jest.Mock).mock.calls[0][1];
expect(callArgs).not.toHaveProperty('details');
});
it('should handle empty details object', () => {
const result = logActivity(
'ACTION',
'/path',
'GET',
undefined,
{}
);
expect(result.details).toEqual({});
expect(logger.info).toHaveBeenCalled();
});
});
});